Log first, then enforce
In log-only mode you see who would be locked out before the rule takes effect. Only then do you switch to enforce.
Platform & AI
Access Restriction
Make the application reachable only from the networks that need it
An ISMS platform holds an organisation's vulnerabilities, risks and contingency plans. It does not need to be reachable from every network in the world. Access restriction narrows access on the application side: via permitted IP ranges or permitted countries, and optionally in addition via a client certificate verified by the upstream web server. It complements the operator's WAF and VPN; it does not replace them.
ISO/IEC 27001 A.8.20BSI IT-Grundschutz NET.1.1
Features
Your benefits
No accidental lockout
Whoever saves the rules in enforce mode must satisfy them. For emergencies there is a server command that switches the restriction off.
Public parts stay reachable
Exception paths keep public forms, for example for data subject requests or whistleblower reports, and incoming webhooks reachable.
Capabilities
All capabilities at a glance
- IP allowlist for IPv4 and IPv6 in CIDR notation
- Country filter via the GeoIP database
- Optional client certificate, verified by the upstream web server
- Modes: off, log only, enforce
- Exception paths for public forms and webhooks
- Self-lockout protection when saving
- Emergency exit via server command
Result
Your compliance data is reachable only from the networks you defined, and nobody locks themselves out in the process.
Experience Access Restriction live
Schedule a no-obligation demo – we will show you the module with your own use cases.